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Message Authentication 

10 The present invention relates to a method for the authentication of data communicated 
from an originator to a destination, to a method for the authenticated transmission of 
messages, to a software program product capable of implementing such a method, to a 
distributed system for communicating authenticated data from an originator to a 
destination as well as to a distributed system for the authenticated transmission of 

15 messages. 

Generally the present invention relates to the field of secure communication setup 
systems and methods which allow the secure communication setup between two 
communication parties, an originator and a destination. In an authenticated (but not 
20 secret) two party communication setup the communication partners and the messages 
exchange must be authenticated meaning that the communicating parties can verify that 
the received messages have not been altered as well as that the sender and receiver are 
authentic. 

25 Generally there are the following four important aspects of secure communication setup 
between two communicating parties: 

- Assurance that the originating communication partner is authorised to 
establish the connection (source is authentic), 

30 - assurance that the receiving communication partner is authorised 

(destination is authentic), 

- assurance that the received message was sent by the originating 
communication partner, and 
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- assurance that the sent and received message has not been altered. 

From the state of the art it is known to use keyed-hashing message authentication 
techniques. General background information on message authentication codes (MAC) 
5 and cryptographic (one-way) hashing can be found for example in Schneyer, Bruce 
„ Applied Cryptography", Edison- Wessley 1996. 

Keyed-hashing for message authentication (HMAC) is a mechanism for message 
authentication using cryptographic hash functions. HMAC can be used with any 
10 iterative cryptographic hash function, e.g. MD5, SH-1 in combination with a secret 
(private) shared key. The cryptographic strength of HMAC depends on the properties of 
the underlying hash function. HMAC uses a secret key for calculation and verification 
of the message authentication values. 

15 Further information on HMAC can be found for example in Bellare et al „Keying hash 
functions for message authentication", Proceedings of Crpyto-96, LNCS 1109, pages 1 
to 15. 

The very first and initial communication step in communication setup (e.g. the login 
20 procedure) is susceptible to copy or replay attacks which send a copy of communication 
setup (e.g. a user name and password recorded from a login procedure) to the 
communication partner. This problem is usually solved with additional knowledge about 
the communication partner at the other side and/or using large random session keys or 
transaction keys (usually taken from a transaction hearing). 

25 

It is the object of the present invention to provide for a technique reducing the risk of 
copy or replay attacks particularly in the first step of a communication setup in a more 
efficient way. 
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This object is achieved by means of the features of the independent claims. The 
dependent claims develop further the central idea of the invention. 
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According to the present invention therefore a method for the authentication of data 
communicated from an originator to a destination is provided. A keyed-hashing 
technique is used according to which data to be authenticated is concatenated with a 
private key and then processed with a cryptographic hash function. The data are then 
5 transmitted together with the digest of the hash function from the originator to the 
destination. The data comprise temporal validity information representing the limited 
temporal validity of the data. 

The temporal validity information can be defined by the originator. 

10 

The data can comprise random data which are unique for a time span defined by the 
temporal validity information. 

The data can be a login key for a communication setup and/ or a message. 

15 

According to another aspect of the present invention a method for the authenticated 
transmission of messages is provided. A login key is at first generated by a keyed- 
hashing method on the basis of random data, temporal validity information and a 
private key. The login key is transmitted from an originator to a destination. The 
20 authenticity and the temporal validity of the login key is verified on the basis of the 
keyed-hashing digest on the destination side. 

In case the verification of the authenticity and the temporal validity of the login key is 
positive, further acknowledgement steps can be effected. An acknowledgement key can 
25 be generated by a keyed-hashing method on the basis of second random data and the 
private key. The acknowledgement key is transmitted from the destination to the 
originator. The acknowledgement key is then verified by the originator. 
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The acknowledgement key can furthermore comprise a time stamp and when verifying 
the acknowledgement key it can be checked on the basis of the time stamp and the 
temporal validity information whether the acknowledgement key is still valid. 
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The method can furthermore comprise message transmission steps in case the 
verification of the acknowledgement key is positive. The second random data of the 
acknowledgement key are extracted. A message is generated by a key hashing method 
on the basis of the second random data, message data and the private key. The message 
is then transmitted from the originator to the destination and the message is verified by 
the destination. 

The message can furthermore comprise a time stamp and when verifying the message it 
is checked on the basis of the time stamp and the temporal validity information whether 
the message is still valid. 

According to a still other aspect of the present invention a software program product is 
provided implementing, when loaded into a computing device of a distributed system, a 
method according to anyone of the preceding claims. 

According to a still other aspect of the present invention a distributed system for 
communicating authenticated data from an originator to a destination is provided. The 
system is designed for a keyed-hashing technique according to which data to be 
authenticated is concatenated with a private key and then processed with a 
cryptographic (one-way) hash function. The data are then transmitted together with the 
digest of the hash function from the originator to the destination. The data thereby 
comprised temporal validity information representing the temporal validity of the data. 

The originator can be designed to define the temporal (limited) validity information. 

The data can comprise random data which are unique for a time span defined by the 
temporal validity information. 

The data can be a login key for a communication setup and/or a message. 

According to a still other aspect of the present invention a distributed system for the 
authenticated transmission of messages is provided. The distributed system comprises 
an originator designed to generate a login key by a keyed-hashing method on the basis 



of random data, temporal validity information and a private key. Furthermore, a 
network for transmitting the login key from the originator to a destination is provided. 
The destination is designed to verify the authenticity and the temporal validity of the 
login key on the basis of the keyed-hashing digest. 

The destination can be designed to generate an acknowledgement key by a keyed- 
hashing method on the basis of second random data and the private and to transmit the 
acknowledgement key to the originator in case the verification of the authenticity and 
the temporal validity of the login key is positive. The originator is designed to verify 
the acknowledgement key. 

The acknowledgement key can furthermore comprise a time stamp and when verifying 
the acknowledgement key the originator checks on the basis of the time stamp and the 
temporal validity information whether the acknowledgement key is still valid. 

The originator can be designed to extract the second random data from the 
acknowledgement key in case the verification of the acknowledgement key is positive, 
to generate the message by a keyed-hashing method on the basis of the second random 
data, message data and the private key and to transmit the message to the destination. 
The destination is designed to verify the message. 

The message can furthermore comprise time stamp and when verifying the message, the 
destination checks on the basis of the time stamp and the temporal validity information 
whether the message is (still) valid. 

Further features, advantages and objects of the present invention will become evident 
for the man skilled in the art when reading the following description of an embodiment 
taken in conjunction with the figures of the enclosed drawings. 

Figure 1 shows hand shake and information flow between two 
communication partners with a time synchronised communication setup 
by keyed-hashing message authentication (TSCS), 
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Figure 2 shows the TSCS login key and acknowledgement key, and 
Figure 3 shows the internal structure of a TSCS login key. 

According to the time synchronised communication setup by keyed -hashing message 
authentication (TSCS) almost all setup keys are unique by using a secure random 
number generator. The setup key is only valid within a given time interval that is 
dynamically defined by the communication originator. The information sender and 
receiver authenticate each other. Only if both partners are authenticated, the 
information will be accepted by the communication partner. After the time interval is 
exceeded the setup key is invalid and cannot be reused again. Within the time interval 
the setup key can be reused. This feature is realised without storing of login keys. 

The communication partners share only a single private (secret) key (of arbitrary 
length) which can be exchanged periodically using known secure protocols (e.g. a 
public key encryption method). The TSCS communication setup protocol is inherently 
robust against copy or replay attacks. As mentioned above, TSCS relies on the keyed- 
hashing for message authentication code (HMAC). It is known from the prior art that 
HMAC is hard to break even if the underlying secure hash function (e.g. SHA-1 or 
MD-5) has some weakness such as predictable collisions. 

Figure 1 shows handshake and information flow between two communicating partners 
with the Time Synchronized Communication Setup by Keyed-Hashing Message 
Authentication (TSCS). 

In phase 1 the information originator generates a TSCS login key and sends the login 
key to the receiver. As shown below a TSCS login key consists of a (secure) random 
bit array, a unified system time, a temporal validity field and its authentication key. If 
the random bit array is large the chance of generation of generating two identical 
random arrays is very small. The receiver receives the login key and checks its 
authentication key. Because of the originator and the receiver share the same private 
key, the login keys digest differs if the login key has been altered (in this case further 
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communication is denied). If the key is valid, the receiver checks its temporal validity 
as described in the validity field. 

In phase 2 the receiver generates a TSCS acknowledgement key and sends it to the 
5 receiver. The acknowledgement key consists of a new random bit array (independent 
from the originator) and the unified system time of the receiver. 

In phase 3 the originator checks the acknowledgement key (i.e. the digest and temporal 
validity), takes the random bit field of the acknowledgement key and merges it with the 
10 message data which is intended to be sent. The data (consisting of the message and the 
random field) is signed and sent to the receiver. 

Then the receiver checks in phase 4 the message digest and the identity of random bit 
field (from the message) and the previously generated random bit array of the 
15 acknowledgement key. If the message digest is valid and the bit arrays are identical, the 
message has mot been altered AND was generated as a result of the previous exchange 
of login and acknowledgement keys. The receiver sends then an acknowledgement to 
the communication originator. 

20 Figure 2 shows the TSCS login and acknowledgement key. The login key is created 
and signed by the communication originator. The acknowledgement key is returned and 
signed by the receiver. The transmitted signature is not necessarily the complete keyed- 
hashing message authentication code (HMAC) with its full digest length. For the login 
and acknowledgement keys it may be meaningful for security and key length to 

25 compress the digest to limit its length. 

Figure 3 shows the internal structure of a TSCS login key. The HMAC key digest may 
be compressed to reduce key length and to prevent the private key K from key break 
attacks if the signed message is short (here 265 bit). A compression to 80 bit digest 
30 length (by a state machine) is appreciated for short message lengths. 

The handshake between the two communicating parties consists of four phases. In the 
following the procedure according to the present invention will be explained in detail. 
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PHASE 1: 

Communication originator login 

a) Generate a TSCS login key 

b) generate of a secure random bit array 

c) append the unified time (UT) field 

d) append the temporal validity field 

e) generate the Keyed-Hashing Message Authentication Code (HMAC) using 
private key K 

f) append the HMAC (or a subset of) to the login key 
g) transmit the login key to the receiver, 

PHASE 2: 

Receiver acknowledgement 

a) [OPTION 1] search the key table for a key that is identical to the current login 
key random bit field 

b) [OPTION 1] if a duplicated key was found in the key table, terminate 
connection and exit. 

c) [OPTION 1] store the random bit array of the login key in the key table until key 
expires 

d) verification of the login key authenticity and validity 

e) check the login key signature (the digest) 

f) calculate own HMAC using private key K 

g) compare own HMAC with login key 
digest 

h) check the login key temporal validity 

i) calculate the difference between login key universal time and current 

time (of the receiver), 
j) check if time difference (the absolute value) is less then the temporal 
validity of the login key 
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k) generate the acknowledgement key 

1) generate secure random bit array (the session key) 
m) store session key 
n) append the unified time (UT) field 
5 o) generate the Keyed-Hashing Message Authentication Code (HMAC) using 

private key K 

p) append the HMAC (or a subset of) to the acknowledgement key 
q) transmit acknowledgement key to communication originator 



10 PHASE 3: 

Message transmission 

a) verification of the acknowledgement key authenticity and validity 
b) check the acknowledgement key signature (the digest) 
1 5 c) calculate own HMAC using private key K 

d) compare own HMAC with acknowledgement key digest 
e) check the acknowledgement key temporal validity 

f) calculate the difference between acknowledgement key universal time 
and current time (of the originator). 
20 g) check if time difference (absolute value) is less then the temporal 

validity of the acknowledgement key 

h) extract the random bit field from acknowledgement key 

i) append or merge the random field (the session key) with the message data 
j) [OPTION 2] append universal time (of the originator) to the message 

25 k) sign the message data and session key (and optionally universal time), i.e. 

calculate HMAC of message data and session key using private key K 
1) append HMAC (or a subset of) to the message data and session key 
m) transmit the message, i.e. transmit the message data, session key and HMAC to 

the receiver 

30 



PHASE 4: 
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Message verification 

a) verification of the message authenticity (and optionally validity) 

b) compare the session key of the message with the previously stored session key 

c) check the message signature (the digest) 

d) calculate own HMAC using private key K 

e) compare own HMAC with message digest 

f) [OPTION 2] check the message temporal validity 

g) [OPTION 2] calculate the difference between message universal time 
and current time (of the receiver) (optionally) 

h) [OPTION 2] check if time difference (absolute value) is less then the 
temporal validity of the acknowledgement key (optionally) 

i) return an acknowledgement to the communication originator 

OPTION 1 is designed to eliminate so-called reply attacks (multiple use of the 
TSCS login key) even if the time span according to the appended temporal 
validity field is not yet expired. Note that said time span can be user defined 
between some nanoseconds and some minutes. Particularly in an Internet 
environment the time span will be chosen to be very long, wherein in direct 
connected networks it will be chosen to be quite short. 

OPTION 2 gives the possibility to define a further time span for the temporal 
validity of the message itself. 

As explained the invention relates to authenticated transmission of messages in 
distributed messaging and (multimedia) telecommunication systems. Time synchronized 
message and communication authentication can be also applied to a common message 
based communication between two communication partners. With minimal extension 
the TSCS can be also applied to 1-to-N communication like broadcast. The present 
invention relates to message oriented communication. Logically, message oriented 
communication means here that in an initial step the communication is established, then 
the message is send and in a third step an (optional) acknowledgement is returned by 
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the receiving party. Message oriented communication is not effective for applications 
that require continuous (uni- or bi-directional) data transmission such as in real-time 
voice or video transmissions. 

5 A technique for realizing secure authentication of communication setup and message 
transmission between two communicating parties is described. Time Synchronized 
Communication Setup by Keyed-Hashing Message Authentication (TSCS) provides the 
ability of 



10 • Authentication of communicating partners. 

• Authentication of transmitted information. 

• Communicating partners share only a single private key that can be periodically 
changed (between the partners) by using state-of-the-art public key encryption for 
key transmission. 

15 • Limited temporal validity (from nanoseconds to days) of session keys that enhances 
communication security and limits the chance and the effects of copy or replay 
attacks, 

• Unsolicited message data sent from replay attacks will be (almost) detected, 

• When secure random keys are stored during their time of validity (from nanoseconds 
20 to days), replay attacks during the initial communication setup phase (which does not 

harm message integrity) are (almost) impossible, 

• Formerly exchanged session keys can (almost) never be reused again after a defined 
time interval (defined by the communication originator). This key property is 
realized without the storage of session keys. 

25 • Limitation (inherent in the apparatus) of the temporal validity of transmitted 
information. 



